Privacy Policy
1. Who we are
Pitchsafe Ltd ("Pitchsafe", "we", "us") operates the Pitchsafe platform. For questions about this policy or to exercise your rights, contact hello@pitchsafe.io.
2. What we collect
- Account data: name, email address, password (stored only as a one-way hash), team membership and role, plan and billing identifiers. If you sign in with Google, Google shares your name, email address and profile photo with us, and we store your Google account ID.
- Billing data: handled by Stripe. We hold your Stripe customer and subscription identifiers, not your card details.
- Content you submit: pitch descriptions, brand details, campaign objectives, paralegal questions, report comments, support tickets, document requests, and the names or handles of creators you ask us to screen.
- Demo submissions: the brand description you type into the homepage demo, with a one-way hash of your IP address (not the address itself) so we can limit how often the demo runs.
- Usage and device data: server logs and session records, which include your IP address and browser details, the pages and features you use, and error diagnostics.
- Email preferences: which briefings you receive, when, and in which timezone.
3. Cookies and similar storage
We use only cookies that are strictly necessary to run the Service. We do not use analytics, advertising or tracking cookies, and we do not load third-party analytics scripts.
- pitchsafe-session: keeps you signed in and ties your requests together. It expires after 1 day of inactivity.
- XSRF-TOKEN: protects forms against cross-site request forgery. It lasts as long as your session.
- remember_web_…: set only if you tick "Remember me", to keep you signed in on that device for up to 400 days or until you sign out.
- Appearance setting: your light or dark mode choice is kept in your browser's local storage, not in a cookie, and is never sent to us.
If you pay through Stripe Checkout or sign in with Google, those services set their own cookies on their own sites under their own policies.
4. Why we use it (lawful bases)
- To provide the Service (performance of our contract with you): running pitch checks, the paralegal, creator screens, the library, briefings and billing.
- Our legitimate interests: securing and maintaining the Service, preventing abuse, and understanding how it is used from our own server records. We balance these against your rights.
- Consent: where the law requires it. You may withdraw consent at any time.
- Legal obligation: where we must keep or disclose data by law, for example tax records.
We may use content and usage data, in aggregated or de-identified form, to operate and improve the Service, including search and report quality. Under our AI provider's commercial terms, content we send through its API is not used to train its models.
5. Sub-processors and sharing
We share personal data with these service providers, who act on our instructions under data-protection terms:
- Anthropic: AI processing (classifying pitches, writing reports, answering paralegal questions, triaging creator screens). Receives the content you submit for those features.
- Voyage AI: text embeddings for search. Receives search text built from your pitch or question.
- Stripe: payments, subscriptions and invoices. Receives billing details.
- Resend: sending account, report and briefing emails. Receives your email address and the email content.
- Xpoz: searching public social media for creator screening. Receives the creator names or handles you enter.
- Replicate: generating ideation moodboard images. Receives the image prompts built from your pitch.
- Sentry: error monitoring. Receives technical details of errors, which can include your user ID and the request that failed.
- Our cloud hosting provider: hosting our servers, database and backups.
If you choose to sign in with Google, Google acts as an independent provider of that sign-in; we receive only the profile details listed in section 2. We do not sell personal data. We may disclose data where the law requires it or to protect our rights.
6. International transfers
Several of these providers are based in, or process data in, the United States and other countries outside the UK. Where personal data leaves the UK, we rely on UK adequacy regulations (including the UK-US data bridge where the recipient is certified) or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Contact us for details of the safeguard that applies to a provider.
7. How long we keep it
- Your account and its content: kept while your account is open. You can delete your account in Settings; that deletes your account, your personal team and the reports in it from our live database straight away. Work in a shared team belongs to that team and stays with it.
- Reports: kept until you or your team delete them. Deleting a report removes it, its findings and any creator screens attached to it.
- Ideation images: deleted automatically 30 days after they are generated.
- Demo submissions: submissions that don't lead to an account are deleted automatically after 12 months.
- Sessions: expire after 1 day of inactivity and are then removed.
- Billing records: invoices and payment records are kept for six years after the end of the financial year they relate to, as UK tax law requires. Stripe keeps its own records under its own obligations.
- Activity log: we record changes to reports and other records (for example a status change) to support you and protect the integrity of the Service. Entries can outlive the record they describe; ask us and we will delete entries about you unless we need them for a legal claim.
- Error reports: kept by Sentry for its standard retention period, then deleted.
- Backups: deleted data can remain in routine backups until those backups are overwritten.
8. Your rights
Subject to applicable law, you may request access, correction, deletion, restriction or portability of your data, or object to certain processing, and you may withdraw consent. Contact hello@pitchsafe.io; we will respond within the statutory timeframe, normally one month. You may also complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.
9. Security
We implement reasonable and appropriate technical and organisational measures to protect personal data; see our Security page. No system is completely secure, and we provide the Service without warranty as to security.
10. Children
The Service is for business users and is not directed to children. We do not knowingly collect personal data from children.
11. Changes
We may update this policy; the "last updated" date shows the current version. We will tell account holders about material changes where the law requires it.